TECHNOLOGY GOVERNANCE IN A TIME OF CRISIS COVID‑19 RELATED DECISION SUPPORT CONTENTS 1 FOREWORD 2 INTRODUCTION 5 BACKGROUND AND PERSPECTIVES UNDERSTANDING THE CHARACTERISTICS 19 OF TECHNOLOGIES 37 DEFINING A GOVERNANCE MODEL APPENDIX 1: POSTCOVIDATA 65 IMPACT STUDY APPENDIX 2: COMPARISON TABLE 79 OF 11 INITIATIVES 83 APPENDIX 3: PIA STUDY REPORTS 142 BIBLIOGRAPHY 144 CONTRIBUTORS 146 OUR PARTNERS This report does not constitute legal advice and is provided for information purposes only. FOREWORD In our collective psyche, epidemics are one of the evils that threaten our existence. The COVID‑19 crisis has shown, vividly and abruptly, that an epidemic can also disrupt society and paralyze the world economy. In this challenging situation for public policy‑makers and business leaders, technology is clearly a valuable asset, both for combating the pandemic and for reopening society in the medium term. The roles played by IT‑based responses also raise ethical questions. In keeping with its mission, at the request of its part‑ ners, the Human Technology Foundation undertook this study to determine how, in the current context, technology can still be used to benefit humanity. The study was led by a steering committee chaired by Jean‑Louis Davet, Chief Executive Officer of Denos Health Management. The work was carried out according to the Foundation’s signature method, bringing together international, multidisciplinary experts, namely specialists in the target technologies, lawyers and ethicists, supported by the teams in our Paris and Montréal offices. We collaborated with researchers from the Intern‑ 1 ational Observatory on the Societal Impact of AI and Digital Technology (OBVIA) and instructors/researchers from several universities located in Montréal, Lille, Sherbrooke and Namur. Also taking part were member lawyers of ITechLaw and staff from partner companies such as Samsung and EY. The study was supported by institutions such as the Chambre de la sécurité financière du Québec and the Mutualité Française. I would like to thank the thirty or so experts who rose to the occasion and contributed their skills, parti‑ cularly the members of the steering committee and coordinating team. Beyond the current crisis, we hope that the method developed and set out in this report will be of use in selecting and governing IT‑based responses to this new situation, which is likely to remain with us for some time. We hope you find our report rewarding. Eric Salobir Executive Committee Chair Human Technology Foundation INTRODUCTION NEVER BEFORE HAS A PANDEMIC SPREAD ACROSS A WORLD SO ABUNDANT IN TECHNOLOGIES AND DATA. WHILE NOT ENABLING ALL COUNTRIES TO SUFFICIENTLY ANTICIPATE THE IMPACT OF COVID‑19 FROM ITS ONSET, THE POWER OF DIGITAL TECHNOLOGY HAS BEEN LEVERAGED UNIVERSALLY TO ACCELERATE SCIENTIFIC RESEARCH, LIMIT THE SPREAD OF THE EPIDEMIC AND NOW FACILITATE THE REOPENING OF BUSINESSES. However, use of this significant power can also approach aims to provide them with the means for present its own risks and raise concerns that may analyzing and deciding on the use of technologies even slow the adoption of proposed solutions. Often to safely exit the crisis and accelerate a healthy caught up in a tangle of constraints or contra‑ return to normalcy. This report can be read on two dictory orders, public and private decision‑makers levels: the first addresses decision‑makers across are faced with choosing between the lesser of all types of organizations and governance bodies, two evils. In particular, the effectiveness of health and the second is more specifically geared to measures, safeguards for individual liberties, dig­ businesses. ital sovereignty, social inclusion and widespread adoption of the proposed measures are the issues Developed during the COVID­19 crisis, the pro­ at stake. posed method in fact heralds a more general 2 approach (which will be the subject of future work) Citizens are questioning politicians on the social for implementing algorithmic and personal data impacts of the health and IT‑based systems they are processing, whose adoption and proper use involve considering. Businesses are turning to the authorities fundamental ethical considerations. for concrete recommendations to follow and guide‑ lines defining their responsibilities. Employees are This approach can be naturally extended to other challenging their employers about how real their areas of healthcare, where the crisis has catalyzed commitments are to social responsibility and work‑ underlying existing trends, paving the way for in‑ place safety. Governments are calling on various creasingly digital and data‑intensive health services. intermediary bodies that can facilitate adoption of Even more broadly, this method could be adapted the measures they recommend, without actually to make ethics an enabler and not a constraint imposing them. And businesses are also trying to for developing digital services whose sensitive assess the ways and means available to promote nature requires a contextualized approach in our the buy‑in for protective solutions among their democratic societies. employees. Customers are challenging the right of a store owner to oblige them to take a particular Our proposed methodological approach consists action to enter the store, or even to benefit from of several stages: special conditions. So many different situations! So many ethical beliefs and values tossed around by all • Setting up an appropriate governance body, and sundry, on either side of the fence. In the end, which brings together all stakeholders and steers they are all dilemmas and constraints for those who the project from design stage through completion have to decide on or manage the implementation of (return to “normal” health conditions), and has IT‑based health protection measures. technical, ethical and legal expertise. This report and its proposed methodology are • Building a single frame of reference. Often‑ primarily addressed to such decision­makers. This used analogies to familiar situations (plague, war, terrorism, mass surveillance, etc.), conjure • The second part provides an overview of the main up images and mould our perceptions of the technologies available with regard to health, situation. Some biases cause decision‑makers technical and societal issues. Particular attention to prefer certain solutions while others trigger is paid to the most impactful issues, such as the rejection or opposition from those the solutions nature of the data collected, how the data are are intended for. Clearly, the choice of mindset is processed and stored (centralized/decentralized/ key. Among other things, it helps build a shared hybrid), the security aspects related to the tech‑ vision of the issues at stake. nology used, etc. This part also aims to make the IT­based aspect understandable for decision­ • Clear identification of needs (tracing individuals makers from outside the industry. carrying the virus, studying community behaviour, monitoring compliance with health measures, • The third part sets out in detail the methodology 3 controlling access to private spaces, etc.), taking and accompanying tools. It presents the multi‑ into account the overall health system in which an factor impact matrix we developed and how it is IT‑based solution is to be used. used. The matrix is presented in its entirety in the appendix. The method has been fully applied to • In‑depth analysis of available technologies and a selection of responses illustrating the diversity the technical, safety, ethical and legal issues of anti­COVID­19 IT­based solutions developed related to deploying them. around the world. Eleven solutions were analyzed in depth by an international team of experts in • Based on the foregoing, a decision­making pro­ technology, health, ethics and law. The results and cess should be rolled out using a multifactor lessons learned from this work are highlighted matrix that involves all project stakeholders. The in the different sections of the report and inform considerations incorporated in this process will our recommendations. Appendices include a make it possible to identify risks and understand comparative table of these 11 responses, as well as how to mitigate them, pave the way for broad summaries of the analyses carried out on each. adoption of the chosen measures, and determine the governance conditions and how they should Jean­Louis Davet evolve over time. President, DENOS Health Management Senior Advisor Human Technology Foundation This report is made up of three main parts: • The first part focuses on the anthropological, social and ethical aspects related to the IT‑based responses for exiting the health crisis. In particular, it discusses the different mindsets, principles and values conducive to achieving the crucial shared frame of reference mentioned above. CHAPTER 1 BACKGROUND AND PERSPECTIVES Decision­makers, public and private, institutional and business alike, now find themselves facing a flood of opinions that raise issues of ethics around the IT‑based health crisis solutions they are weighing. However, against the complexity of a pandemic, accepting every argument that claims ethical legitimacy would result in paralysis. So it is essential to clarify which legal and ethical principles to favour. The social acceptability of a technology does not depend solely on its accessibility, effectiveness, explainability and easy applicability for a wide audience, or on the related technical, legal and ethical precautions. Our level of acceptability also